diff --git a/aspnetcore/security/preventing-open-redirects.md b/aspnetcore/security/preventing-open-redirects.md index acd0804ec3e5..0cd967b36fb1 100644 --- a/aspnetcore/security/preventing-open-redirects.md +++ b/aspnetcore/security/preventing-open-redirects.md @@ -50,7 +50,7 @@ public IActionResult SomeAction(string redirectUrl) `LocalRedirect` will throw an exception if a non-local URL is specified. Otherwise, it behaves just like the `Redirect` method. -### IsLocalUrl +### IUrlHelper.IsLocalUrl Use the method to test URLs before redirecting: @@ -70,4 +70,25 @@ private IActionResult RedirectToLocal(string returnUrl) } ``` -The `IsLocalUrl` method protects users from being inadvertently redirected to a malicious site. You can log the details of the URL that was provided when a non-local URL is supplied in a situation where you expected a local URL. Logging redirect URLs may help in diagnosing redirection attacks. +The `IUrlHelper.IsLocalUrl` method protects users from being inadvertently redirected to a malicious site. You can log the details of the URL that was provided when a non-local URL is supplied in a situation where you expected a local URL. Logging redirect URLs may help in diagnosing redirection attacks. + +:::moniker range=">= aspnetcore-10.0" + +### Detect if URL is local using `RedirectHttpResult.IsLocalUrl` + +The [`RedirectHttpResult.IsLocalUrl(url)`](https://source.dot.net/#Microsoft.AspNetCore.Http.Results/RedirectHttpResult.cs,c0ece2e6266cb369) helper method detects if a URL is local. A URL is considered local if the following are true: + +* It doesn't have the [host](https://developer.mozilla.org/docs/Web/API/URL/host) or [authority](https://developer.mozilla.org/docs/Web/URI/Authority) section. +* It has an [absolute path](https://developer.mozilla.org/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_URL#absolute_urls_vs._relative_urls). + +URLs using [virtual paths](/previous-versions/aspnet/ms178116(v=vs.100)) `"~/"` are also local. + +`IsLocalUrl` is useful for validating URLs before redirecting to them to prevent [open redirection attacks](https://brightsec.com/blog/open-redirect-vulnerabilities/). + +```csharp +if (RedirectHttpResult.IsLocalUrl(url)) +{ + return Results.LocalRedirect(url); +} + +:::moniker-end